Analysis
-
max time kernel
150s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21-11-2024 11:36
General
-
Target
f1f9e35c3db8e2523fe15cbb58a6a597404087771d94eab864f651d3452d0c37.exe
-
Size
3.6MB
-
MD5
4a09de0d523a1a2207005a826c1a0ea0
-
SHA1
69db3c2309c335c119af541f7639e2048821c507
-
SHA256
f1f9e35c3db8e2523fe15cbb58a6a597404087771d94eab864f651d3452d0c37
-
SHA512
7a68992abc4932530cda33143ff5372a8047bc268fda7795c1c33001f28989fdd58c75d4af364ea3eb6ccf3809540e1e15670dd0de1155893a435ed90e4fc17b
-
SSDEEP
49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB5B/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpCbVz8eLFcz
Malware Config
Signatures
-
Drops startup file 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f1f9e35c3db8e2523fe15cbb58a6a597404087771d94eab864f651d3452d0c37.exe"C:\Users\Admin\AppData\Local\Temp\f1f9e35c3db8e2523fe15cbb58a6a597404087771d94eab864f651d3452d0c37.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevbod.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevbod.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\IntelprocWQ\aoptisys.exeC:\IntelprocWQ\aoptisys.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.6MB
MD539f51802ad507bec999de46d48bbecb9
SHA13ea358c25b13f6f1145064b7b48d4fa9d88e40e6
SHA256125fd9f0adbd621cf536a247eb1bcfe2be69ad538f59127f18dfd0f65b8b9af8
SHA5126283ffcaeeb0e4ee763175d833f1e7513bf313ac400adfa351295a723e30e60deef2ab4d41dae950f22341aac6ef948f3a70678bd273291de5827c57b5eb284a
-
Filesize
206B
MD5309137705eb27c92e2c17f1aaef1e2ec
SHA1bd95894a0127c7efc6b136403f266c02e26bcb19
SHA256a74f2aa961cd69cd01def97c874231884b72f6650653582126390f17d057c664
SHA5120f96fd9714487cddeec3784832a23adaf2a7bbe513207f8e318ab4b2dbd9feaeeec334419fe2c4f7d773a5fd21896f10c026317dccf36fc090019ecb711925a7
-
Filesize
174B
MD584c8d6925e3a08f437cc6208a8783828
SHA1fa40c2d2623f6e6d2da3c3c60ab0de02605ce98f
SHA2568394e19ca790d5d8e12fc5bb9a6eeb2fc9b83d6c2b0db43634411a18db982724
SHA512482fb2cc3afcce9b2995491aa9cdaa190f988c7d57da15f246939b4d06525a8ed29ef50eb366b2324705a5489ce823b3f1f2e2e321fc2174b0a0a440de0700c1
-
Filesize
3.6MB
MD5824361ebb0e4ba08b34da9fd8aa069a4
SHA1e59a385a0d9f8734ffd00f9b75399bb2bdc6aaa6
SHA256fb985fe632d52982eb2281a23514922d1e0eaeb0f69fc9a825285cf35e035438
SHA512e35fb134a945308e628696951c44725759ef17e9c4b3e885399303d2f33aa54c04c9dee3540556dad0bd7e4689677d9e6543cbefbf4846c08677f172036997b7
-
Filesize
10KB
MD51b916c50de9513bd35995ff6e69aef92
SHA152937fef400b241d4a8b1ddd227652b7c677d4bb
SHA25687b86902356dc8919842b25007d34f46886d02128a2a02cb251d67dde3bccbe0
SHA5127d45f793fac4540d35fd63f20caf5172cb11727e67a9016311072bbe1de9cbfac63ba2f8cb9bc93bb3b067ce7a65d0ee23b7d88fc199ffd6728e49343007d85e
-
Filesize
9KB
MD516a4bb0fc3d5c44be3028068af1ea1ef
SHA13525da0805ed7773dfef437f24482b727389e9db
SHA256cab09a5b3c3d84c5b8a2e11a35c3fcb95b6436b3dff8502d6b224492feb4c94d
SHA512b487b3eb68c80afed0c6cdc0573c466508b36730b7cb654a78fd17c162030a3e5fc360589888ecede135747d71fa86eb3f8f59425aa66780d4645629b11efe9b